[ Vendor · 20 CVEs ]
pypa
CVEs affecting pypa published in the last 30 days, plus any pypa CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113732 | 20 Oct 2026 | CVSS 7.8 | virtualenv activate.fish runs commands from a path or prompt with a backslash before a quotevirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which… | Fix |
| CVE-2026-113776 | 20 Oct 2026 | CVSS 7.8 | virtualenv activation scripts run code from a path that contains a placeholder namevirtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template()… | Fix |
| CVE-2026-113726 | 20 Oct 2026 | CVSS 7.8 | virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the… | Fix |
| CVE-2026-113724 | 20 Oct 2026 | CVSS 4.5 | virtualenv: Deletion recovery can change a symlink target's modevirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error handler responds to a… | Fix |
| CVE-2026-113725 | 20 Oct 2026 | CVSS 7.8 | virtualenv bash activate runs commands from an environment name with a backslash before $virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for… | Fix |
| CVE-2026-113717 | 20 Oct 2026 | CVSS 2.3 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip… | |
| CVE-2026-113718 | 20 Oct 2026 | CVSS 7.1 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote() uses repr() to write… | |
| CVE-2026-113719 | 20 Oct 2026 | CVSS 4.5 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall._uninstall_previous_version() accepts existing… | |
| CVE-2026-113720 | 20 Oct 2026 | CVSS 4.4 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached… | |
| CVE-2026-113721 | 20 Oct 2026 | CVSS 4.5 | virtualenv: Generated files can follow existing destination linksvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() removes an existing output… | Fix |
| CVE-2026-113722 | 20 Oct 2026 | CVSS 7.8 | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely… | Fix |
| CVE-2026-113723 | 20 Oct 2026 | CVSS 7.1 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in… | |
| CVE-2026-113715 | 20 Oct 2026 | CVSS 2.0 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with… | |
| CVE-2026-113716 | 20 Oct 2026 | CVSS 4.5 | virtualenv: Builtin creation follows linked environment directoriesvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure_dir() for executable… | Fix |
| CVE-2026-113714 | 20 Oct 2026 | CVSS 2.3 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads directly… | |
| CVE-2026-113713 | 20 Oct 2026 | CVSS 4.4 | pypa virtualenvvirtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment… | |
| CVE-2026-102938 | 29 Sep 2026 | CVSS 5.8 | virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the… | Fix |
| CVE-2026-102925 | 29 Sep 2026 | CVSS 7.8 | virtualenv bash and fish activation scripts execute commands embedded in pathsvirtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish… | Fix |
| CVE-2026-102930 | 29 Sep 2026 | CVSS 7.7 | virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before usevirtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels… | Fix |
| CVE-2026-102937 | 29 Sep 2026 | CVSS 7.3 | virtualenv: Command injection via --prompt in activate.bat (batch activator)virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before… | Fix |